What is the CVSS score of CVE-2026-61140?

CVE-2026-61140 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebCenter Sites are affected by CVE-2026-61140?

Oracle WebCenter Sites 14.1.2.0.0 contains a critical remote takeover vulnerability exploitable over the network without authentication, allowing complete compromise of the content management…

How to fix or mitigate CVE-2026-61140?

Within 24 hours, identify all systems running WebCenter Sites 14.1.2.0.0 and implement immediate network-level access controls to restrict inbound HTTP/HTTPS traffic to trusted sources only. Within 7 days, deploy a Web Application Firewall with rules to detect and block exploitation attempts, enforce access restrictions on administrative functions, and establish continuous monitoring for anomalous activity patterns. Within 30 days, monitor Oracle's support channels for patch availability and develop a remediation plan including either immediate upgrade to a patched version or migration to an alternative platform.

Oracle WebCenter Sites CVE-2026-61140

EUVD-2026-47348 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-vm23-97ff-m564

Authentication Bypass Oracle Webcenter Sites

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle states unauthenticated, easily exploitable HTTP access yielding full takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H and unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:35 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover in Oracle WebCenter Sites 14.1.2.0.0 allows an unauthenticated attacker with only HTTP network access to fully compromise the product, yielding complete confidentiality, integrity, and availability loss (CVSS 3.1 9.8). Disclosed in the Oracle Critical Patch Update of July 2026 and reported by Oracle's own security alert team, it is rated easily exploitable but has no public exploit identified at time of analysis. WebCenter Sites is Oracle's enterprise web experience/content management platform, so a compromise means attacker control over the delivery of managed web content.

Technical ContextAI

Oracle WebCenter Sites (formerly FatWire) is a Java/Oracle Fusion Middleware web experience management (WEM) and content management system used to author, manage, and deliver marketing and corporate web content at scale. The affected build is 14.1.2.0.0, part of the 14c release line running on the Fusion Middleware / WebLogic stack. The advisory does not enumerate a CWE (CWE: N/A) and Oracle's terse CPU wording does not name the specific defect class, but the combination of unauthenticated network HTTP access leading to full 'takeover' with high CIA impact is consistent with common WebCenter Sites weakness patterns such as authentication bypass, insecure deserialization, or an injection/RCE path exposed through an HTTP-facing servlet or endpoint. Oracle applied the vendor tag 'Information Disclosure,' though the CVSS impact set (C:H/I:H/A:H) indicates the consequences extend well beyond disclosure to full compromise.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 as documented at https://www.oracle.com/security-alerts/cpujul2026.html; this is Patch available per vendor advisory, as the input provides the CPU reference but no discrete standalone fix build number, so administrators should pull the exact WebCenter Sites 14.1.2.0.0 patch from the CPU matrix and My Oracle Support rather than an invented version string. Because this is an unauthenticated HTTP-reachable takeover, prioritize patching internet-facing WebCenter Sites instances first. Until the CPU is applied, reduce exposure with compensating controls: restrict network access to the WebCenter Sites administrative and delivery endpoints to trusted networks or a VPN, place the application behind a WAF or reverse proxy with rules limiting anonymous access to management URLs, and enforce IP allow-listing on the WebLogic/HTTP tier - noting the trade-off that overly broad restrictions can break legitimate content-delivery or authoring traffic and CDN origins, so scope rules to management paths where possible and validate against production traffic before enforcing.